Privacy First

The ThreatDoc desktop app works fully offline. Documents you never choose to sync never leave your device. Local content is encrypted at rest using a key tied to that device.

When you first open the application, the desktop app generates an account key and shows it to you exactly once. Every document you sync from then on is encrypted on your device with a key derived from it before any of it reaches our servers.

What we actually store is ciphertext, plus a small verification blob that lets us confirm you've entered the right key without ever learning what that key is. We cannot decrypt your document content. Not as a policy but as built in architecture. There's no administrative override, no support ticket backdoor, no key escrow.

Because we never see the key, we also can't recover it if it's lost. That's the trade off of a genuinely zero knowledge system.

Never store or sync Controlled Unclassified Information in any of our cloud storage.

A document added to a team is reencrypted under a key shared by that team, so any active member can open it. Only team members can access the ciphertext, but we do not handle decryption keys.

Team keys (and personal account keys) can be rotated at any time from the desktop app. Rotation reencrypts affected documents under a new key, which is the mechanism for cutting a departed team member off from anything synced afterward. It can't reach back and revoke a copy someone already downloaded.

• Document contents is never in plaintext without your key.
• A breach of our infrastructure would expose ciphertext, not readable findings.
• Losing your account or team key means losing access to the documents encrypted with it, save it somewhere durable when it's shown to you.
• Account/team management data (your email, plan, team roster, billing) is separate from document content and is readable by us, since we need it to actually run the service.

• TLS in transit for everything that leaves your device
• Row level security enforced at the database level, an account can only reach its own or team's rows
• Private, access controlled storage with short lived signed URLs.
• Two factor authentication available on every account